CA ehealth. Traffic Accountant and NetFlow Administration Guide. r6.1

Transcription

1 CA ehealth Traffic Accountant and NetFlow Administration Guide r6.1

2 This documentation and any related computer software help programs (hereinafter referred to as the Documentation ) is for the end user s informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the Documentation for their own internal use, and may make one copy of the related software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the Product are permitted to have access to such copies. The right to print copies of the Documentation and to make a copy of the related software is limited to the period during which the applicable license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user s responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO THE END USER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION, LOST PROFITS, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF SUCH LOSS OR DAMAGE. The use of any product referenced in the Documentation is governed by the end user s applicable license agreement. The manufacturer of this Documentation is CA. Provided with Restricted Rights. Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (b)(3), as applicable, or their successors. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Copyright 2008 CA. All rights reserved.

3 CA Product References This document may reference the following CA products: CA ehealth AdvantEDGE View CA ehealth Application Response CA ehealth Business Service Console (ehealth BSC) CA ehealth Distributed ehealth CA ehealth Fault Manager CA ehealth Live Health Application CA ehealth Response CA ehealth Service Availability CA ehealth SystemEDGE CA ehealth TrapEXPLODER CA ehealth Voice Quality Monitor (VQM) CA ehealth AIM for Apache CA ehealth AIM for Microsoft Exchange CA ehealth AIM for Microsoft IIS CA ehealth AIM for Microsoft SQL Server CA ehealth AIM for Oracle CA Insight AIM for CA ehealth CA Insight Database Performance Monitor for Distributed Databases (CA Insight DPM for Distributed Databases) CA ehealth Integration for Alcatel (ehealth - Alcatel) CA ehealth Integration for Cisco IP Solution Center (ehealth - Cisco ISC) CA ehealth Integration for Cisco WAN Manager (ehealth - Cisco WAN Manager) CA ehealth Integration for HP OpenView (ehealth - OpenView) CA ehealth Integration for Lucent (ehealth - Lucent) CA ehealth Integration for Netcool (ehealth - Netcool) CA ehealth Integration for Nortel Preside (ehealth - Nortel Preside) CA ehealth Integration for Nortel Shasta SCS GGSN (ehealth - Nortel GGSN) CA ehealth Integration for Psytechnics (ehealth - Psytechnics)

4 CA ehealth Integration for Starent PDSN (ehealth - Starent PDSN) CA SPECTRUM CA Unicenter Network and Systems Management (Unicenter NSM) CA etrust Identity and Access Management (etrust IAM) CA Embedded Entitlements Manager (CA EEM) Note: CA Embedded Entitlements Manager (CA EEM) is the new name for etrust IAM. This product will be rebranded throughout the documentation in a future release. CA XOsoft Replication Contact CA Contact Technical Support For online technical assistance and a complete list of locations, primary service hours, and telephone numbers, contact Technical Support at Provide Feedback If you have comments or questions about CA product documentation, you can send a message to techpubs@ca.com (mailto:techpubs@ca.com). If you would like to provide feedback about CA product documentation, please complete our short customer survey, which is also available on the CA Support website.

5 Contents Chapter 1: Using ehealth to Monitor Traffic in Your Infrastructure 9 The Value of Traffic Data... 9 ehealth Traffic Data Collection Methods... 9 How ehealth Collects Traffic Data from Cisco-Enabled Devices How ehealth Collects Traffic from Cisco NetFlow Collectors How ehealth Collects Traffic Data from RMON2 Probes The Value of Traffic Accountant Reports How ehealth Identifies the Top Conversations Chapter 2: Installing and Configuring Traffic Accountant Components 17 Meet System Requirements Traffic Accountant Installation Considerations License Your Traffic Accountant System How to Configure the ehealth NetFlow Collector to Collect Data How ehealth Imports Conversation Data from the ehealth NetFlow Collector How to Configure the ehealth Import Poller to Collect NetFlow Data How ehealth Imports Conversation Data from Cisco NetFlow Collectors How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network How ehealth Collects Conversation Data from the RMON2 Conversations Poller How to Migrate RMON2 Configuration Data from an NPO System to ehealth Chapter 3: Managing Traffic Accountant 33 How to Import NetFlow Elements Automatically How to Terminate Polling of NetFlow Elements How to Terminate Polling of Probe Elements How to Assess the Status of the ehealth Database How to Prevent Traffic Accountant Resource Overutilization How to Manage the Growth of Your Traffic Accountant Database How to Reduce the Number of Hours That ehealth Retains Conversation Data How to Remove Unwanted Node or Node-Address Pairs from the Database How to Manage the Poller Message Files How to Manage the Conversations Rollup Scheduled Job How to Modify Configuration Information for Cisco NetFlow Collectors How to Switch the Data Collection Mode for the Import Poller How to Collect Bi-Directional Data with the Standard Import Poller How to Troubleshoot Problems with Your Cisco NetFlow Collector Contents 5

6 How to Troubleshoot Problems with Polled NetFlow Devices Chapter 4: Using Views and Groups 49 How to Organize Nodes and Autonomous Systems View Planning Organizational Views Probe Views Geographic Views Functional or System-Type Views Unassigned Nodes Group Create a Traffic Accountant View How ehealth Creates a Probe View Copy a Traffic Accountant View Import a Traffic Accountant View Export a Traffic Accountant View Rename a Traffic Accountant View Delete a Traffic Accountant View Create a Traffic Accountant Group Modify a Traffic Accountant Group Delete a Group Update Views Chapter 5: Traffic Accounting Reporting 67 Types of Traffic Accountant Reports Pie Charts Bar Charts Trend Charts Tabular Charts Report Center Traffic Accountant Reports Default Traffic Accountant Reports Aggregation Reports Run a Traffic Accountant Report through Report Center Schedule a Traffic Accountant Report Job through Report Center Quick Start Traffic Accountant Reports Run a Quick Start Report from the ehealth Console Run a Quick Start Report from the Web User Interface Standard Traffic Accountant Reports Run a Traffic Accountant Report from the ehealth Console Schedule a Traffic Accountant Report Job through the ehealth Console How to Customize a Standard Traffic Accountant Report Modify a Copy of a Standard Report Traffic Accountant and NetFlow Administration Guide

7 Rename a Report How to Configure the Node Name Display in Reports Automate the Process of Changing the Name Node Display in Reports How to Add Custom Applications to Traffic Accountant Reports How to Maintain ehealth Report Files Appendix A: Subnet Masks 111 IP Addresses, Subnets, and Subnet Masks Calculate the Subnet Mask Appendix B: Running a Dedicated Traffic Accountant ehealth System 113 Guidelines for Disabling Extraneous Processes Edit the Startup.cfg File Index 115 Contents 7

8

9 Chapter 1: Using ehealth to Monitor Traffic in Your Infrastructure This section contains the following topics: The Value of Traffic Data (see page 9) ehealth Traffic Data Collection Methods (see page 9) The Value of Traffic Accountant Reports (see page 14) The Value of Traffic Data Traffic data is any data that is sent from one node to another node within a network. A node is a device in your network that has a network address. When one node sends data to another node, the data transfer is called a conversation. Each conversation has a node pair (that is, a sending node and a receiving node). A conversation can be a request to determine whether a system is active (known as a ping), or it can be a file transfer operation, an e- mail message, or a request to a web server. Traffic data can also be data that is sent from one autonomous system to another autonomous system within a network. An autonomous system (AS) is a collection of networks under a common administration sharing a common routing strategy. Traffic data can be useful for planning and implementing network security, reconfiguration, growth, partnering, and provisioning. This type of data can help you to correlate network costs to the devices, subnetworks, external customers, internal users, and organizations or departments that use your network. ehealth Traffic Data Collection Methods ehealth Traffic Accountant includes the following product components that you can use to collect traffic data that is generated in your network: ehealth NetFlow Collector ehealth Import Poller Traffic Accountant RMON2 Conversations Poller Using ehealth to Monitor Traffic in Your Infrastructure 9

10 ehealth Traffic Data Collection Methods The ehealth NetFlow Collector collects node-to-node and AS-to-AS NetFlow traffic data directly from Cisco routers and switches in the network via a userdefined port. NetFlow is an open but proprietary network protocol developed by Cisco Systems to run on Cisco IOS-enabled equipment for collecting IP traffic information. The enhanced ehealth Import Poller collects NetFlow data by extracting data files from Cisco NetFlow Collectors that are installed throughout your infrastructure. To use either of these data collection methods, you must install Traffic Accountant on a dedicated, standalone ehealth system. To analyze the data, you can generate reports through the Report Center user interface. (You cannot generate reports on this data through the ehealth console or the Run Reports page of the ehealth Web user interface.) As an alternative method for monitoring NetFlow traffic, you can use the standard ehealth Import Poller to collect either node-to-node or AS-to-AS data from Cisco NetFlow Collectors in your network. If you have installed RMON2 probes throughout your infrastructure, you can use the Traffic Accountant RMON2 Conversations Poller to collect RMON2 traffic data from the probes. To use either of these data collection methods, you should install Traffic Accountant on a dedicated, standalone ehealth system. To analyze the data, you can generate reports through the ehealth console or the Run Reports page of the ehealth Web user interface. (You cannot generate reports on this data through the ehealth Report Center user interface.) How ehealth Collects Traffic Data from Cisco-Enabled Devices If you install the ehealth NetFlow Collector (ENFC) in your network, you can use it to capture end-to-end conversation data directly from Cisco NetFlowenabled devices in your network. This data provides details about the protocols and ports used, and the end nodes that are exchanging data. In addition, it can also include information on Multi-Protocol Label Switching (MPLS), Border Gateway Protocol (BGP), multicast, and AS-to-AS traffic. If you use the ENFC, you do not need to install a Cisco NetFlow Collector. The ENFC is a passive collector; it does not poll NetFlow devices at regular intervals to collect traffic data. Instead, it resides on the Traffic Accountant system and listens for UDP NetFlow data packets in a port. It waits until NetFlow interfaces send data, and then processes it. You can configure the ENFC to listen to specific ports and aggregate the data in a specific way. When you use the ehealth NetFlow Collector to collect conversation data, ehealth does the following: 1. Stores the raw NetFlow data in a database table. 2. Processes the data to obtain conversation data observed by NetFlow-enabled devices in your network. 10 Traffic Accountant and NetFlow Administration Guide

11 ehealth Traffic Data Collection Methods 3. Discovers each Cisco NetFlow interface that is sending data to the ENFC. 4. Creates a probe element for each NetFlow interface and stores it in the ehealth database. 5. Adds the conversation data for each device to the ehealth database. 6. Automatically receives more traffic data from each device at each interval. For instructions on configuring the ENFC to collect NetFlow data, see How to Configure the ehealth NetFlow Collector to Collect Data (see page 19). How ehealth Collects Traffic from Cisco NetFlow Collectors If you have installed one or more Cisco NetFlow Collectors in your network, you can install the ehealth Import Poller to import NetFlow traffic data from the collectors. Cisco NetFlow Collectors are workstations that collect and process the conversation data sent from Cisco routers and switches that exist in your network. By default, the enhanced ehealth Import Poller collects node-to-node and ASto-AS data simultaneously. However, if you configure the Import Poller to use standard data collection, you can collect only one type of data at one time. To collect both types of data using the standard ehealth Import Poller, you must install Traffic Accountant on two separate ehealth systems. When you use the ehealth Import Poller to retrieve conversation data, the following occurs: 1. Each Cisco NetFlow Collector filters and aggregates the conversation data that it collects from each device. 2. The collectors save the data as flat files in a directory on the NetFlow Collector workstation. 3. The ehealth Import Poller retrieves the data files from the Cisco NetFlow Collectors via File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), or Tectia SSH FTP. 4. The poller stores this data in the ehealth database. Important! If you run the poller in standard mode, you cannot collect nodeto-node and AS-to-AS data simultaneously. To do so, you must install ehealth Traffic Accountant on two separate ehealth systems. Using ehealth to Monitor Traffic in Your Infrastructure 11

12 ehealth Traffic Data Collection Methods To use the ehealth Import Poller, you need to configure it by running the setup program. As part of the configuration, you discover the NetFlow interfaces, and then ehealth saves them as NetFlow probe elements in the database. (If you have not already created a NetFlow scheduled job, you must discover the devices to enable ehealth to poll them.) Note: For instructions on using the ehealth Import Poller, see How to Configure the ehealth Import Poller to Collect NetFlow Data (see page 21). How ehealth Collects Traffic Data from RMON2 Probes If you install remote monitoring version 2 (RMON2) dialog probes in your network, you can use ehealth Traffic Accountant software to collect RMON2 traffic data. A probe is a device that contains RMON2 software that records information about network traffic conversations occurring between nodes on the network (as specified in the latest version of the management information base (MIB) specification, RMON, version). Although the information collected by each probe can vary, a probe typically identifies the address of the sending node, the address of the receiving node, the number of packets and bytes transmitted, and the protocol or application type of the data. 12 Traffic Accountant and NetFlow Administration Guide

13 ehealth Traffic Data Collection Methods Using Simple Network Management Protocol (SNMP) agents, ehealth searches particular ports for the IP addresses of the probes that you specify. After ehealth discovers each probe, it adds it the database as a probe element. A probe element is a single interface on a probe which behaves as a virtual probe. Some probes can have many interfaces, but a useful limit can only be determined by the amount of data that a probe sees. Traffic Accountant discovers probe interfaces, not probes. A probe element learns about the nodes around it by observing the conversations and reading the addresses of the node pairs. If a node does not send or receive any traffic, a probe element does not know that the node exists. The following illustration shows an example of two network segments, each with its own nodes and probe element. The darker lines represent conversations that occur between these nodes: NodeA and Node2 NodeC and NodeB Node1 and Node2 Probe elements see only the conversations that take place on the network segment where the probe element resides. Either one or both of the nodes must reside on or send data on the segment where the probe element resides. Using ehealth to Monitor Traffic in Your Infrastructure 13

14 The Value of Traffic Accountant Reports For example, Probe1 sees the conversations between NodeA and Node2, and NodeC and NodeB. Probe1 does not see the conversation between Node1 and Node2 because both of those nodes are on a different segment. Similarly, Probe2 sees the conversations between NodeA and Node2, and between Node1 and Node2. Probe2 does not see the conversation between NodeC and NodeB because those nodes are on a different segment. When ehealth retrieves conversation data from RMON2 probes, it follows this process: 1. Poll the probe elements to obtain the probe elements conversation data. 2. Filter out any conversation data that is below a defined minimum size or older than a user-defined date. 3. Save the conversations and top conversations in the database. The Value of Traffic Accountant Reports If you install ehealth Report Center, you can use the Report Center user interface to generate reports on the data that you collect using the ehealth NetFlow Collector or the enhanced ehealth Import Poller. To analyze the data that you collect using the standard ehealth Import Poller or the RMON2 Conversations Poller, however, you must generate reports through the ehealth console or the Run Reports page of the ehealth Web user interface. Traffic Accountant reports identify how nodes, autonomous systems, and applications use your network. You can use this information to analyze the network and address traffic problems. These reports can help you determine the following: The nodes or autonomous systems that use the network the most The nodes or autonomous systems that use specific nodes or autonomous systems Whether any unassigned nodes are accessing certain network resources The volume trends for a node or autonomous system, group of nodes or autonomous systems, or a network segment The applications that are used the most on the network by a certain node or autonomous system, or on a network segment Traffic usage patterns for cost-effective partnering 14 Traffic Accountant and NetFlow Administration Guide

15 The Value of Traffic Accountant Reports How ehealth Identifies the Top Conversations When you run a standard Traffic Accountant report from the ehealth console or the Run Reports page of the ehealth Web user interface, ehealth analyzes the data to determine which conversation records are the most accurate. The most accurate record of a conversation is the top conversation. ehealth uses the top conversations when you run Traffic Accountant reports from the ehealth console or the Web user interface for all probe elements or all NetFlow-enabled interfaces. Since different elements might have observed the same conversations, ehealth only analyzes the top conversations to avoid including redundant information in the reports. ehealth calculates the top conversations by comparing the data for each node or autonomous system pair as recorded by any probe or NetFlow element. If only one element observes the conversations between a node or autonomous system pair, ehealth automatically considers those records to be the top conversation records. When more than one element observes conversations between the same node or autonomous system pair, ehealth compares the total amount of conversation data for the node pair as observed by each element. ehealth chooses the element that has the largest amount of conversation data for the node or autonomous system pair. It considers all conversation records observed by that element for that node or autonomous system pair to be the top conversations. When you run a report for a specific element, ehealth uses the information returned by the element, regardless of whether the records are top conversations. Using ehealth to Monitor Traffic in Your Infrastructure 15

16

17 Chapter 2: Installing and Configuring Traffic Accountant Components This section contains the following topics: Meet System Requirements (see page 17) Traffic Accountant Installation Considerations (see page 18) License Your Traffic Accountant System (see page 18) How to Configure the ehealth NetFlow Collector to Collect Data (see page 19) How to Configure the ehealth Import Poller to Collect NetFlow Data (see page 21) How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network (see page 28) Meet System Requirements The standard ehealth installation program allows you to install Traffic Accountant as an optional component. CA does not support the collection of statistics data and conversations data on a single system. Because the volume of Traffic Accountant data can become quite large and consumes a large amount of data storage capacity, you should install it on a separate system that is dedicated to ehealth Traffic Accountant. To use ehealth s NetFlow data collection capabilities, you must install Traffic Accountant on a dedicated, standalone ehealth system, and the ehealth system platform must meet the system requirements for ehealth. Prior to installing Traffic Accountant, follow these steps to meet system requirements: 1. Review the Traffic Accountant Resource Requirements Document located on the Support web site to estimate the amount of memory and disk space required for a Traffic Accountant installation. 2. Access the ehealth Sizing Wizard on the ehealth product web site. Respond to the series of questions, wait for ehealth to calculate the system resources required to support your ehealth implementation, and note the requirements. 3. See the Cisco user documentation to confirm that your NetFlow Collectors, switches, and routers meet system requirements. Note: Most ehealth Import Poller performance impacts relate to the size of the files; that is, larger files take longer to process than smaller files that ehealth imports from the Cisco NetFlow Collectors. Installing and Configuring Traffic Accountant Components 17

18 Traffic Accountant Installation Considerations Traffic Accountant Installation Considerations Review the following considerations before you install or upgrade ehealth Traffic Accountant: Upgrading any ehealth system that is not a pristine Traffic Accountant system will cause installation problems. Report Center is required to generate reports about data collected by ehealth Netflow Collector and by the NetFlow import poller running in enhanced mode. You must run the Traffic Accountant-specific installation with the Traffic Accountant-specific LCF file. License Your Traffic Accountant System Before you can use any Traffic Accountant components to collect RMON2 or NetFlow conversation data, you must obtain authorized poller license keys for each device that you want to poll and also obtain a license for Traffic Accountant. Important! By default, the ehealth Import Poller runs in enhanced mode and collects AS-to-AS data and node-to-node data simultaneously from the Cisco NetFlow Collectors in your network. If you configure the ehealth Import Poller in standard mode and you want to collect node-to-node and AS-to-AS traffic statistics simultaneously, you must install two ehealth Traffic Accountant licenses on two separate ehealth systems. To add one or more ehealth licenses to your Traffic Accountant system 1. Log in to The Technical Support page appears. 2. Select the licensing tab. The Licensing page appears. 3. Click on the ehealth Network License Request Form, complete the fields, and click Submit. The Licensing department sends you a set of authorized product license keys for the designated ehealth system. 4. Create a backup copy of your license.dat file in the ehealth/lmgr directory. 5. Do the following: a. Open the license.dat file that resides in the ehealth/lmgr directory. b. Open the message that Licensing sent to you. 18 Traffic Accountant and NetFlow Administration Guide

19 How to Configure the ehealth NetFlow Collector to Collect Data 6. Copy and paste the keys from the message into the file to overwrite the existing entries with the contents from the message. Important! Be sure to copy only the license.dat portion of the message. If you inadvertently include the header information, the license will not function correctly. 7. Save the file and close it. 8. Do one of the following: On a Windows system, select Start, Control Panel, Administrative Tools, Services. On the Services page, select the FlexLM and ehealth server processes, right-click, and select Stop. After the processes stop, select the FlexLM and ehealth server processes again, right-click, and select Start. ehealth restarts the processes and enables your licenses. On a UNIX system, enter the following: cd ehealth/bin nhlmgr stop nhlmgr start ehealth restarts the license manager and enables your licenses. How to Configure the ehealth NetFlow Collector to Collect Data If you install Traffic Accountant and configure the ehealth NetFlow Collector (ENFC), you can collect data directly from Cisco routers and switches that are in your network. The ENFC supports Cisco routers up to version 9.0 and imports both node-to-node and AS -to-as data simultaneously. You can install one ENFC on each ehealth system that you have, and configure each one by running an interactive script from the ehealth console. If you install an ENFC, you do not need to install a Cisco NetFlow Collector in your network. To configure the ENFC 1. If you have not already done so, do the following: a. Install Traffic Accountant on each workstation that you designate as an ehealth system. For instructions, see the ehealth Installation Guide for your platform. b. Confirm that your ehealth system and Cisco devices meets system requirements. For instructions, see Meet System Requirements. (see page 17) c. Obtain license keys for Traffic Accountant and each probe element that you want to poll. For instructions, see License Your Traffic Accountant System (see page 18). Installing and Configuring Traffic Accountant Components 19

20 How to Configure the ehealth NetFlow Collector to Collect Data 2. Log in to the ehealth system as the ehealth administrator. 3. In a terminal window, change to the ehealth installation directory. 4. If ehealth is installed on a UNIX system, use one of the following commands to source the appropriate ehealth resource file to set your environment: Shell Bourne C Korn Command. nethealthrc.sh source nethealthrc.csh. nethealthrc.ksh 5. Start ehealth by entering the following command: ehealth 6. In the ehealth console, select Setup, Configure, NetFlow to display the nhnetflowsetup window. 7. Select 1 to install the ENFC. 8. Specify the collection port (9991 is the default), and then press Enter. ehealth lists all predefined aggregators. 9. Select an aggregator by name or by index. 10. Select Y to activate it. 11. Enter 4 to save the aggregator setting to the ehealth database. 12. Configure additional aggregator by repeating Steps 8 through 11. How ehealth Imports Conversation Data from the ehealth NetFlow Collector The ENFC listens for UDP NetFlow data packets in the port that you specified during the installation. When NetFlow interfaces send data, the ENFC processes it and stores it in the database. After ehealth discovers the Cisco NetFlow interfaces and creates probe elements for them, it adds the conversation data for each device to the ehealth database. At each poll, ehealth automatically retrieves more traffic data from each device. The NetFlow Collection window in the OneClick for ehealth console displays the time of the next poll. Green bars indicate the number of ehealth elements that were polled successfully. The Errors bar graph displays red bars to indicate the number of elements that ehealth did not poll successfully. The NetFlow Collection window updates with each new poll. 20 Traffic Accountant and NetFlow Administration Guide

21 How to Configure the ehealth Import Poller to Collect NetFlow Data Each data file processed by the ENFC contains one interval. This interval is set within the ENFC and refers to the period within which it usually matches the NetFlow Collection interval value (the default is 15 minutes). A poll bar indicates the number of Cisco NetFlow-enabled router interfaces that had data for a given polling cycle. A separate poll bar represents each interval. To view error messages related to NetFlow-enabled devices, check the ehealth/log directory. How to Configure the ehealth Import Poller to Collect NetFlow Data If you install Traffic Accountant and have one or more Cisco NetFlow Collectors installed in your infrastructure, you can configure the ehealth Import Poller to collect NetFlow data from Cisco routers and switches that exist in your network. By default, the enhanced ehealth Import Poller collects node-to-node and AS-to-AS data simultaneously. The standard Import Poller allows you to collect only one type of data at one time. To collect both types of data using the standard Import Poller, you must install Traffic Accountant on two separate ehealth systems. Cisco NetFlow Collectors filter and process NetFlow data according to specific aggregation schemes. Since the standard ehealth Import Poller supports a subset of the available aggregation schemes, you must ensure that you configure your NetFlow Collectors with one of the following supported active aggregation schemes: DetailASMatrix or HostMatrixInterface if you are running ehealth Traffic Accountant in node-to-node mode ASMatrix if you are running ehealth Traffic Accountant in AS-to-AS mode Note: If you use a non-supported aggregation scheme, ehealth cannot provide conversation data. For information on setting an aggregation scheme on a NetFlow Collector, see the Cisco documentation on the Cisco Web site at The ehealth Import Poller ignores aggregations that contain unsupported fields. The following table lists all fields that are currently supported. Aggregation Field PROCESS_TIME ROUTER_ADDR ELEMENT_ID MACHINE_ID Value NOT NULL NUMBER(11) VARCHAR2(45 CHAR) NUMBER(11) NUMBER(11) Installing and Configuring Traffic Accountant Components 21

22 How to Configure the ehealth Import Poller to Collect NetFlow Data Aggregation Field SOURCE_ID UNIX_NSECS VERSION AGGREGATION_ID SRC_IP_ADDR SRC_IP_ADDR DST_IP_ADDR DST_PORT PROTOCOL TOS INPUT_IF_IDX OUTPUT_IF_IDX SRC_MASK DST_MASK FLOW_BYTES FLOW_PACKETS IP_NEXT_HOP SRC_AS DST_AS BGP_IP_NEXT_HOP IPV6_FLOW_LABEL PACKET_TYPE MPLS_TOP_LABEL_TYPE MPLS_TOP_LABEL_IP SRC_MAC DST_MAC SRC_VLAN DST_VLAN IP_VERSION DIRECTION Value NUMBER(11) NUMBER(11) NUMBER(2) NUMBER(11) VARCHAR2(45 CHAR) NUMBER(11) VARCHAR2(45 CHAR) NUMBER(11) NUMBER(3) NUMBER(5) NUMBER(11) NUMBER(11) NUMBER(3) NUMBER(3) NUMBER(38) NUMBER(38) VARCHAR2(45 CHAR) NUMBER(11) NUMBER(11) VARCHAR2(45 CHAR) NUMBER(8) NUMBER(11) NUMBER(5) VARCHAR2(45 CHAR) NUMBER(15) NUMBER(15) NUMBER(5) NUMBER(5) NUMBER(1) NUMBER(1) 22 Traffic Accountant and NetFlow Administration Guide

23 How to Configure the ehealth Import Poller to Collect NetFlow Data Aggregation Field MPLS_LABEL1 MPLS_LABEL2 MPLS_LABEL3 MPLS_LABEL4 MPLS_LABEL5 MPLS_LABEL6 MPLS_LABEL7 MPLS_LABEL8 MPLS_LABEL9 MPLS_LABEL10 SAMPLE_INTERVAL SAMPLEALG FLOW_SAMPLER_ID FLOW_SAMPLER_MODE RANDOM_INTERVAL IF_NAME IF_DESC SAMPLER_NAME FRAGMENT_OFFSET FORWARDING_STATUS TCP_FLAG FLOW_END FLOW_START MIN_PKT_LEN MAX_PKT_LEN MIN_TTL MAX_TTL FLOWS IPV4_IDENT Value NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(11) NUMBER(5) NUMBER(5) NUMBER(5) NUMBER(11) VARCHAR2(32 CHAR) VARCHAR2(255 CHAR) VARCHAR2(255 CHAR) NUMBER(5) NUMBER(3) NUMBER(3) NUMBER(11) NUMBER(11) NUMBER(5) NUMBER(5) NUMBER(3) NUMBER(3) NUMBER(38) NUMBER(5) Installing and Configuring Traffic Accountant Components 23

24 How to Configure the ehealth Import Poller to Collect NetFlow Data You can use the NetFlow Collector User Interface (NFUI) to display runtime configuration parameters, resource definitions, and statistics, as well as modify existing configuration parameters and define new configuration parameters. For detailed instructions, see your Cisco NetFlow user documentation for the NFUI. To configure the ehealth Import Poller to collect NetFlow data 1. If you have not already done so, do the following: a. Install one or more Cisco NetFlow Collectors within your network by following the instructions provided in your Cisco NetFlow installation documentation.if you have installed the ehealth NetFlow Collector already, you do not need to install a Cisco NetFlow Collector. For instructions, see How to Configure the ehealth NetFlow Collector to Collect Data (see page 19). Note: To collect NetFlow data on the network using the ehealth Import Poller, you must install one or more NetFlow Collectors within your infrastructure. You cannot use this poller unless you install these collectors. b. Install ehealth on each workstation that you designate as an ehealth system. For instructions, see the ehealth Installation Guide for your platform. c. Confirm that your Cisco NetFlow Collectors, ehealth system, and Cisco routers and switches all meet system requirements. For instructions, see Meet System Requirements (see page 17). d. Obtain license keys for Traffic Accountant and each probe element that you want to poll. For instructions, see License Your Traffic Accountant System (see page 18). 2. Collect the following configuration information regarding your Cisco NetFlow Collector: a. Hostname of the NetFlow Collector system. b. IP address of the NetFlow Collector system (the setup procedure attempts to derive the IP address from the hostname of the NetFlow Collector system, so you may be able to accept the default). c. User name that ehealth can use to log in to the NetFlow Collector system (default is nhuser). d. Password for this user on the NetFlow Collector system. e. Full pathname of a directory on the NetFlow Collector system on which the NetFlow Collector software is installed (default is /opt/csconfc). 3. Log in to the ehealth system as the ehealth administrator. 4. In a terminal window, change to the ehealth installation directory. 24 Traffic Accountant and NetFlow Administration Guide

25 How to Configure the ehealth Import Poller to Collect NetFlow Data 5. If ehealth is installed on a UNIX system, use one of the following commands to source the appropriate ehealth resource file to set your environment: Shell Bourne C Korn Command. nethealthrc.sh source nethealthrc.csh. nethealthrc.ksh 6. Start ehealth by entering the following command: ehealth 7. In the ehealth console, select Setup, Configure, NetFlow to display the nhnetflowsetup window. 8. At the first prompt, enter 2 to install the ehealth Cisco NetFlow Import Poller. 9. At the next prompt, enter 1 to set up a new NetFlow Collector; then enter 1 to add a new collector. 10. At the next prompt, enter the hostname of the Cisco NetFlow Collector workstation to enable ehealth to locate this workstation on the network. One of the following occurs: If it locates the hostname, it obtains the workstation s IP address. If it cannot locate the workstation, it displays an error message indicating that the hostname does not respond to ping. Although the system cannot locate this workstation, you can still use the workstation name. Enter y at the prompt. If you enter n, the system prompts you again for the name of the host. 11. At the next prompt, enter the IP address of the NetFlow Collector and specify the type of FTP that you would like ehealth to use to access the NetFlow system. Do one of the following: If you select SFTP, create a login without a password on which you have configured the NetFlow Collector. Enter the following: $ ssh-keygen t rsa Installing and Configuring Traffic Accountant Components 25

26 How to Configure the ehealth Import Poller to Collect NetFlow Data Enter file in which to save the key (/ehealth/user/.ssh/id_rsa); then enter the same passphrase again. ehealth saves the login information in /ehealth/user/.ssh/id_rsa, and it saves your public key in /ehealth/user/.ssh/id_rsa.pub. Copy the public key to the Cisco NetFlow system by doing the following: $ ssh-copy-id i ~/.ssh/id_rsa.pub username@netflowmachine If you select FTP, specify a user name and password that ehealth can use to access the NetFlow Collector. If the nhnetflowsetup script cannot establish an FTP session with the NetFlow Collector workstation, you cannot import data from the NetFlow Collector. Check the user name and password for this NetFlow Collector, and enter the correct information when prompted. If this information is correct, you may have a network connectivity problem. Note: As an alternative, ehealth also supports Tectia SSH FTP. 12. Enter the pathname of the directory on the NetFlow Collector workstation in which NetFlow is installed. ehealth saves the settings. 13. Specify the type of data collection to use. By default, the Import Poller runs in enhanced mode and collect AS-to-AS data and node-to-node data simultaneously from the Cisco NetFlow Collectors in your network. Note: When you use enhanced data collection, you can generate Traffic Accountant reports through the Report Center user interface. 14. Enter the polling interval to specify how often (in minutes) ehealth collects information from the NetFlow Collectors. The default is 15 minutes. ehealth time-aligns the NetFlow data to the interval of the Conversations Poller. For example, if the Conversations Poller is 30 minutes, ehealth time aligns the data to the half hour. If the data is less than the conversations polling interval, ehealth stores the data to its internal cache for at least 30 minutes and then writes the data to the database. 15. Enter the maximum amount of time (in minutes) to allow a data extraction to finish before timing out. The default is 15 minutes. 16. Press Return. The nhnetflowsetup script saves all of the NetFlow Collector information. 17. To configure the Import Poller to import data from another NetFlow Collector, repeat Steps 9 through Traffic Accountant and NetFlow Administration Guide

27 How to Configure the ehealth Import Poller to Collect NetFlow Data 18. Use ehealth to discover probe elements for each NetFlow-enabled device interface that reports data to the NetFlow Collectors: a. Log in to the ehealth console. b. Select Setup, Import Elements, NetFlow. The NetFlow Import Elements dialog appears. c. Optionally, specify a Database Configuration Information (DCI) exclusion rules file to filter the ehealth probe elements prior to adding them to the ehealth database. Click Browse; then select the files. For instructions on creating a rules file, see the ehealth Administration Guide. d. In the NetFlow Import Elements dialog, click Discover. e. The Discovering dialog displays status messages under Discovery Results in the Discovering dialog. f. If polling does not begin, the circle in the Import Polling window (in the OneClickEH console) may be blue and the message Waiting for asynch import may appear. If this happens, stop and restart the ehealth server by selecting Tasks and Information, Setup, Server Controls in the left pane of the OneClickEH console. Note: You can stop the discover process at any time by clicking Stop Discovery. ehealth discards all elements listed under Discovery Results and closes the Discovering dialog. Once ehealth completes the discover process, the ehealth Import Poller should begin polling the probe elements at the next poll. How ehealth Imports Conversation Data from Cisco NetFlow Collectors After you configure the Import Poller to extract data files from each NetFlow Collector, you need to use ehealth to discover probe elements for each NetFlow-enabled device interface that has reported data to the NetFlow Collectors, and then save the probe elements in the ehealth database. After the ehealth Import Poller retrieves data files from the NetFlow Collectors in your network and imports them to the ehealth system, it aligns the data to the interval of the Conversations Poller. If the Conversations Poller is 30 minutes, ehealth time-aligns the data to the half hour. If the Cisco NetFlow samples are less than the conversation polling interval, it stores the data to its internal cache until it can be stored to the database. Installing and Configuring Traffic Accountant Components 27

28 How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network Each data file imported from the NetFlow Collector contains one interval. This interval is set within the NetFlow Collector and refers to the period within which the NetFlow Collector wrote the data to the file. For best performance, this interval value should usually match the Import Poller interval value (the default is 15 minutes). In the Import Polling window on the ehealth Status Summary page of the OneClick for ehealth console, green bars show the number of Cisco NetFlow-enabled router interfaces that had data for a given import polling cycle. A separate poll bar represents each interval. To view error messages related to NetFlow-enabled devices, check the ehealth/log directory. When the ehealth Import Poller begins polling for the first time (or after a long hiatus), it reads a backlog of data of up to eight hours. This creates an initial configuration that can be up to eight hours old. ehealth aggregates this data and saves it in the database. How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network If you install ehealth Traffic Accountant software and install probes within your network, you can use the RMON2 Conversations Poller to collect traffic data from the probe elements. Traffic Accountant discovers probe interfaces, not probes. A probe element is a single interface on a probe which behaves as a virtual probe. ehealth polls probe elements, collects information about the conversations that each probe element observed, and then stores this information in its database. To configure the ehealth Conversations Poller to collect RMON2 data 1. If you have not already done so, do the following: a. Install Traffic Accountant on each workstation that you designate as an ehealth system. For instructions, see the ehealth Installation Guide for your platform. b. Confirm that your ehealth system meets system requirements. For instructions, see Meet System Requirements (see page 17). c. Obtain license keys for Traffic Accountant and each probe element that you want to poll. For instructions, see License Your Traffic Accountant System (see page 18). 2. Install one or more probes within your network in areas that maximize the traffic coverage: Internal LANs Interfaces to WANs Subnets on which servers or other important systems reside 28 Traffic Accountant and NetFlow Administration Guide

29 How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network 3. Use the ehealth discover process to add each probe interface to the ehealth database. How ehealth Collects Conversation Data from the RMON2 Conversations Poller After you have discovered your probes and added them to your database, the ehealth Conversations Poller begins to poll them to collect information about the conversations that they observed, and then stores this data in its database. The Conversations Polling window in the OneClick for ehealth console displays information about the Conversations Poller, which uses Simple Network Management Protocol (SNMP) and SNMPv2 to poll discovered RMON2 probe elements for Traffic Accountant data. The window shows the time of the next poll, the number of Good Polls, and the number of Bad Polls. Like the Statistics Polling window, the bars change color to indicate the polling status. ehealth filters the data that it receives from a probe element and ignores information about conversations that are less than a defined minimum size. By default, ehealth does not save information for conversations that are less than 500 bytes per minute for the duration of the polling interval. Thus, if your polling interval is 30 minutes, ehealth does not save information for conversations that are 15,000 (500 x 30) bytes or less. The NH_POLL_DLG_BPM environment variable defines the minimum traffic filter size. To change the default setting of 500 bytes per minute, follow this general procedure. For specific instructions on adding environment variables to your system, see the ehealth Commands and Environment Variables Reference Guide. Important! If you lower or disable the filter size, you could cause a significant increase in your database disk space requirements. To change the default setting of NH_POLL_DLG_BPM, follow these steps 1. Stop the ehealth server. 2. Add this environment variable to your system. 3. Specify a value. If you set it to 0, the filter is disabled and ehealth saves all conversations in the database. 4. Restart the ehealth server. Installing and Configuring Traffic Accountant Components 29

30 How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network Each time that ehealth polls a probe element, it retrieves the data stored within it. A probe element captures information only for the conversations that occur on the network segment, ring, switch port, or interface where the probe is installed. If you have multiple probes in your network, more than one probe element could observe the same conversation. Change the Polling Interval ehealth uses the conversation data to determine which probe element is the best source of information for a node or autonomous system. It totals the byte count for each conversation for each node or autonomous system and compares the totals as recorded by each probe element. ehealth chooses the probe element with the largest byte count for a node or autonomous system as the best source of information for the node. Note: ehealth follows this process when it analyzes RMON2 conversation data that is collected by probes. It does not do so when analyzing data that is collected by the ehealth NetFlow Collector or the enhanced ehealth Import Poller. ehealth polls each probe element to collect data on every conversation that the probe element detected and stored, which can result in a tremendous amount of data being collected at each poll. Consequently, the polling interval for conversation data is longer than that for statistics. Probes vary in the amount of memory that they have, and thus the amount of conversation data that they can store. Use a polling interval that enables you to collect the data from the probes before data is lost due to device memory limitations, counters within the probe reset, or the probe s timeout being reached. 30 Traffic Accountant and NetFlow Administration Guide

31 How to Configure the ehealth Conversations Poller to Collect RMON2 Data in Your Network You should also use a polling interval that allows you to retrieve data from the probe element before it resets counters or discards data. This polling interval value determines the rate at which ehealth stores data in the database. In addition, the number of elements in your database and the amount of disk space available for the database might require you to use a polling interval other than the default. The default polling interval for conversation data is 30 minutes, but you can change it to 15, 30, 45, or 60 minutes. Note: If you discover that some probes do not behave at an optimum level with ehealth, consult with your probe vendor to resolve RMON2 configuration issues. For detailed instructions on the discover and polling processes, see the ehealth Administration Guide. To change the polling interval for conversation data 1. Log in to the OneClick for ehealth console. a. Enter the following in a web browser, where ehealthsystem is the specific name of the system on which ehealth is installed. If your ehealth system is configured to run in a High Availability environment, specify the shared hostname or shared IP address for your system rather than the specific ehealth system name. ehealthsystem/oneclickeh The Connect to ehealthsystemname window appears. b. Specify the user name and password of an administrator who has permission to access OneClickEH; then click OK. The OneClick for ehealth page appears. c. Click Launch OneClick for ehealth. The File Download window appears. d. Click Run. The OneClickEH login window appears. 2. Log in to the ehealth server as an administrator who has permission to manage the pollers. The ehealth Status Summary window appears. 3. In the left pane of the console, click Tasks and Information, Setup, Poller Controls. The Poller Controls window appears. 4. From the Conversations list, select a different poll rate and click Apply. ehealth resets the poll interval and begins polling at that rate. Installing and Configuring Traffic Accountant Components 31